Add OIDC login via Authentik: PKCE, JIT provisioning, email linking (#5)

OIDC is pansy's primary login path (Authentik the target IdP); local
auth (#4) remains the fallback and both issue the same session cookie.

- deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go;
  CGO stays off).
- api/oidc.go: lazy issuer discovery (retried per-request, never crashes
  a server that also serves local auth), GET /auth/oidc/login builds an
  authorization-code URL with PKCE S256 + random state + nonce stashed in
  a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state
  (constant-time), exchanges the code with the PKCE verifier, verifies the
  ID token + nonce, and starts a pansy session. Failures redirect to
  /login?error=... ; success to /gardens.
- service.LoginOIDC: (issuer,subject) match -> login; else *verified*
  email match -> link onto the existing account; else JIT-create (the IdP
  gates access, so PANSY_REGISTRATION doesn't apply). Unverified email
  colliding with an existing account is refused (takeover guard); no email
  is refused (email is the account key). Reuses the atomic CreateUser.
- store: GetUserByOIDC + LinkOIDC (unique-pair backstop).
- config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI);
  /auth/providers now reports oidc from it and defaults the button label
  to "Sign in with Authentik". OIDC routes are only registered when ready,
  so an unconfigured instance 404s them.
- PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC.

Tests: service provisioning (JIT, repeat login, link, unverified-collision
refusal, no-email, name fallback, works with local auth off); api
(routes-absent-when-unconfigured, providers reporting, login redirect with
PKCE params + tx cookie via a fake discovery server, callback state/error
paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable
with the server still up and local auth working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/store/users.go

@@ -105,6 +105,43 @@ func (d *DB) GetUserByEmail(ctx context.Context, email string) (*domain.User, er
 	return u, nil
 }
 
+// GetUserByOIDC returns the user with the given (issuer, subject) identity pair,
+// or domain.ErrNotFound. Both arguments must be non-empty.
+func (d *DB) GetUserByOIDC(ctx context.Context, issuer, subject string) (*domain.User, error) {
+	u, err := scanUser(d.sql.QueryRowContext(ctx,
+		`SELECT `+userColumns+` FROM users WHERE oidc_issuer = ? AND oidc_subject = ?`, issuer, subject))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get user by oidc: %w", err)
+	}
+	return u, nil
+}
+
+// LinkOIDC stamps an OIDC identity onto an existing user (first OIDC login for a
+// pre-existing local account) and returns the updated row. A collision with
+// another user's identity pair trips the UNIQUE index and maps to ErrEmailTaken
+// as a generic conflict (it shouldn't happen — the caller looks up by identity
+// first — but the index is the backstop).
+func (d *DB) LinkOIDC(ctx context.Context, userID int64, issuer, subject string) (*domain.User, error) {
+	_, err := d.sql.ExecContext(ctx,
+		`UPDATE users
+		    SET oidc_issuer = ?, oidc_subject = ?,
+		        version = version + 1,
+		        updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+		  WHERE id = ?`,
+		issuer, subject, userID,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return nil, domain.ErrEmailTaken
+		}
+		return nil, fmt.Errorf("store: link oidc: %w", err)
+	}
+	return d.GetUserByID(ctx, userID)
+}
+
 // CountUsers returns the number of user rows. Used to decide first-user-is-admin
 // and to allow bootstrap registration when signup is otherwise closed.
 func (d *DB) CountUsers(ctx context.Context) (int, error) {